Compliance Management
Episode 12: Monitoring & Review

“Catch me if you can!”

Monitoring & Review is an essential component that adds value to any Compliance Management System (CMS). In my consulting practice, however, I often find that this topic is largely disregarded when it comes to evaluating compliance programs. Many companies implement detailed guidelines and provide training, but do not convince themselves of the effectiveness of these measures. On the one hand, this happens due to the time constraints, but also because compliance officers are reluctant to accept the role of “controller” in their own companies and perceive a conflict of interest in their role as consultant.

What is Monitoring & Review?

Monitoring & Review is all about examining the functionality and effectiveness of a CMS. “By examining the CMS (…) companies receive independent and objective evidence that their CMS is appropriate and effective. (…) The actual function of the individual components of the CMS can only be assessed in an effectiveness check. In addition to the risk-mitigating effect, a CMS check can also be understood as a ‘stress test’ for the company, which helps identify any existing weaknesses (e.g., loopholes) and improve the system”.[1]

Similar information can also be found in the U.S. Foreign Corrupt Practices Act (FCPA) and the UK Bribery Act (UKBA). The US Department of Justice (DOJ) has recently (June 2020) emphasized that a Compliance Program must work in practice — after all, even the best CMS is of no use unless it is implemented or the competent compliance officers verify that it is efficient.

The terms ‘monitoring’, ‘review’, ‘revision’, ‘internal investigation’ and ‘audit’ are often mixed up and cannot always be clearly distinguished from one another. However, the difference between periodic measures, which we would like to refer to as Monitoring & Review here, and internal investigations, should be emphasized. The latter describe ad hoc actions taken in a specific suspected case.

Planning is the key

How should compliance officers embrace it? Prior to planning, you need to determine what you want to test and how you want to test it?

Let us consider the key components of the CMS (also refer to the individual sections of the 12-Month Challenge) as a checklist. The individual components do not only have to be formulated ‘on paper’ – these also have to be fulfilled in a targeted and effective manner.

There are different methods to choose from. On the one hand, you could perform a CMS ‘self-check’ for compliance with the completeness, functionality and efficiency requirements. One question could be, for example: Is the program being implemented as intended? Do the employees actually accept the code of conduct when they join? Does the phone number of the whistleblowing system really work? Have the recommendations for action points arising out of the risk assessments been implemented yet? On the other hand, you could also focus on the monitoring of other functions or the conduct of employees. Ideally, you should check both ‘on-book’, i.e. using invoices, service specifications etc., which could reveal the improper use of funds by foreign subsidiaries, and ‘off-book’, i.e. through practical checks on site. This means that undocumented events can also be discovered, such as diverted cash payments to consultants.

It has proven useful for the planning to enter the individual examinations in an annual plan, to coordinate them with the company’s senior management and then implement them over the course of the year.

Define stakeholders and look for allies

As far as the planning is concerned, however, it is not only important what is to be checked and which method is to be used, but also who will perform the check.

Internal revision/auditors (if any) could also prove useful and assist the compliance officers by contributing their expertise and resources. External help could also help avoid putting Compliance Monitoring & Audit on the back burner and find a starting point. Depending on your local law, also participation of the works council could be required.

Learn from findings!

The best actions and reviews will not help unless conclusions are drawn from the relevant findings. So what do you do if the CMS check reveals loopholes or abnormalities? This actually depends on the type of findings. Should you discover individual misconduct or irregularities, you might need to perform an internal investigation. If, on the other hand, you find that your CMS suffers from structural defects, you should consider improvements to the CMS.

Conclusion:

When it comes to monitoring, the guiding principle is as follows: “Little is more than nothing”, i.e. starting small and, if necessary, working your way forward in individual steps is always better than doing nothing at all. Those who ‘stick with it’ and have their well-designed CMS ‘stress-tested’ on a regular basis will have a clear advantage in the worst-case scenario.

Our 12-Month Compliance Challenge is drawing to a close. We have considered the key CMS components and divided them into individual work packages. Remember, there is only one way to eat an elephant: piece by piece!

If you are unsure how to set up and run your compliance project successfully, please feel free to contact me.

[1] Schmidt, in: Hauschka/Moosmayer/Lösler, Corporate Compliance, 3rd Edition 2016, Section 45 marginal no. 14.

Compliance Management
Episode 11: Due diligence and integration into M&A processes

“I check every offer. It could be the offer of my life.” (Henry Ford)

Due diligence plays a major role in the transaction business. It should enable a risk assessment of the target company and put the purchase decision on a firm footing. This applies to commercial and financial aspects, as well as legal and compliance risks (e.g., corruption risks). The latter is explicitly stipulated in both the Foreign Corrupt Practices Act (FCPA) and the UK Bribery Act (UKBA). It doesn’t always have to be a big deal. Investments or joint ventures also require a close look at the compliance issue.

Compliance as spoilsport?

However, reality sometimes offers quite a different picture. A systematic recording of compliance risks in the run-up to an acquisition according to the given possibilities is rarely performed and usually not in the required depth. It often seems as though you don’t want to let compliance issues jeopardize a promising deal. Accordingly, compliance officers are rarely involved in this phase – a risky undertaking, because errors at this key stage may have far-reaching consequences.

Action plan in the course of due diligence

Due diligence cannot be a full compliance audit, and the absence of abnormalities does not guarantee that problems will not arise later. Nevertheless, a critical examination of the compliance status of the target is extremely important in order to provide for a realistic assessment of both the deal opportunities and its risks.

In addition to the assessment of the compliance risks inherent in the business model, the evaluation of the target company’s compliance management system (CMS) also plays a key role.

Business model evaluation

The evaluation of the business model basically follows the steps that are similar to those of the compliance risk analysis (see Episode 3 of the ’12-Month Compliance Challenge’). The key question is: What factors that pose significant liability risks or company damages can actually be identified? Such factors in the target could be (select):

• Importance of licenses and permits for a company (e.g., as a condition for the operation of plants)
• Degree of regulatory oversight and control
• Involvement of business partners (such as distributors, consultants)
• Special features of the industry (e.g., high regulatory requirements in the pharmaceutical or medical device sector)
• Geographical aspects (unfavorable Corruption Perception Index,[1] political instability)
• Specific problems, i.e. administrative investigations carried out in the past or, as the case may be, ongoing investigations and/or proceedings against company managers, negative press coverage, etc.

Of course, risks may sometimes give rise to business opportunities, and risks are often inherent in business activities and cannot be eliminated. Example: If there is a strong dependency on official decisions, there will almost always be a risk of corruption. However, it could be controlled in the best possible through the implementation of targeted measures such as advice, training, or compliance audits. Accordingly, the aim of Compliance Due Diligence should be to ensure a realistic assessment of the existing compliance risks in the target company.

Compliance program assessment

The critical assessment of the compliance program (see the overview in Episode 1 of the ’12-Month Compliance Challenge’) provides an insight into the status of the risk control and the associated probability, so that these risks will be realized in the form of administrative investigations and the associated financial damage in the foreseeable future. Example: A compliance program is only included in the target for the sake of form. However, there are no guidelines or instructions for employees on how they should deal with requests from consultants for freely available funds, which they “need” to obtain official approvals in China. Such grievances also give a foretaste of the effort that the buyer can expect after the acquisition with the reorganization of the CMS in the target company and the compliance integration. The way in which the target has dealt with indications of irregularities and findings has proven to be a fairly reliable indicator of the CMS condition. Has the information been collected and processed in a comprehensible manner? Have any improvement measures been taken?

Compliance integration

The work really gets underway when the buyer has decided to make the acquisition. The integration of a CMS (if any) is usually a tough job. Above all, it takes a good deal of tact and sensitivity. Different approaches to compliance issues are mostly based on corporate cultural factors: How competitive are the companies in comparison? Is there a high level of oversight and control or are employees given greater leeway in decision-making? Compliance is all about convincing and building trust, rather than doing some things right or wrong.

Conclusion

Compliance aspects must be taken into account in M&A processes in order to prevent damage to the company. Compliance officers should know what kind of investments play a role in their company and work towards being involved in the relevant processes at an early stage. The arguments are on their side.

What’s next

Our ’12 Month Compliance Challenge’ is drawing to a close. Last but not least, our last episode is about Monitoring & Review.

If you are unsure how to set up and run your compliance project successfully, please feel free to contact me.

Compliance Management
Episode 10: Managing Business Partners

In order to denote uncharted and possibly dangerous territories, ancient maps sometimes display the warning “Hic sunt dracones” (“Here there be dragons”). Aside from the topic of Compliance Monitoring & Review, dealing with business partners often represents the largest “blind spot” in a company’s Compliance Management System (CMS). It is estimated that only about half of companies includes its suppliers and subcontractors in its compliance program. The misconception that compliance risks can easily be shifted into business partner’s area of responsibility may contribute to this. That may not be correct. Rather, the following principles apply:

• Companies cannot discharge themselves of responsibility by entrusting third parties with the execution of risky activities
• Moreover, they are generally responsible for what third parties do on their behalf

But what are, in practice, the most important steps towards risk-based management of business-partners?

Taking stock

First, we need to know who is a “business partner” in the first place. This is assessed differently depending on a company’s business area. As a rule of thumb, at least those persons or organizations who work for a company (except employees) or otherwise represent it should be included. Typical examples of business partners are sales partners, customs agents, or consultants. The stock-taking process should include the following questions:

• What does the company need this business partner for?
• What can this business partner do that existing business partners were unable to do?
• Why did the company choose this particular business partner? Is this business partner particularly qualified for the task in relation to others (performance, price, experience)?
• Does the business partner use other business partners in turn? If so, for what purpose and with what specific mandate?

Risk assessment

Business partners must then be evaluated with regard to existing risks. Did the evaluation, for example, find that

• the business partner has regular contact with representatives of local authorities,
• approval sought from the authorities is essential for the company’s business activities in the market,

then this is extremely important information. This reflects considerable compliance (and corruption) risks, without there necessarily having been any concrete evidence of undue influence.

In addition, country and industry risks (Corruption Perception Index and special regulatory requirements) are important indicators, and order volume can also be a reason to take a particularly close look at a business relationship. Last but not least, warning signs, “red flags”, may indicate special risks in individual cases, for example, if the business partner is unknown in the industry, the actual added value by the business partner is unclear, or unusual payment methods (cash payment, off-shore accounts) have been identified.

Review

Depending on the level of risk, business partners must then be reviewed – either retrospectively, if no review has taken place in the past, and/or in a defined process for new business partners. This review is usually summarized under the heading “background checks”, which can be a comparison against the most important “blacklists” (such as the World Bank Listing of Ineligible Firms & Individuals or public corruption registers). Even simple search engine queries can yield interesting results. The higher the risks, the more the business partner must be “put to the test”, in particular through a detailed analysis of beneficial ownership.

Supporting measures

Supporting measures may include contractual provisions and other safeguards, such as the incorporation of compliance clauses, the determination of audit rights, or training courses.

In particular, contractual compliance clauses provide necessary legal leverage to actually exercise control in the business relationship and to be able to react appropriately to irregularities.

Conclusion

Let’s be honest, careful management of business partners can be very costly, and yes, there are some “dragons” lurking here that have to be defeated. However, the result is “win-win”. First, the company protect itself against liability and reputational risks. Second, the transparency and evaluation of business partners produced by this review actually serves a company’s interests, namely in creating a precise understanding of the reason for and the structure of a business relationship, a business partner, and its services provided. From a business perspective, this “inventory” is often long overdue, and will later be reflected in a corresponding return on investment.

What’s Next

In our next – and penultimate – episode, we will deal with due diligence and integration in M&A processes.

If you are unsure how to set up your CMS successfully, please feel free to contact me.

Compliance Management
Episode 9: Reporting system, investigations, sanctions, and incentives

Lady Justice carries not only scales, but also a sword. Compliance programs are designed to avert problems, but they do occur. When they do, they must be monitored and handled professionally. The range of measures extends from introducing of a reporting system to launching investigations and imposing sanctions. Incentive systems can also be a powerful tool, yet they are used only by a few companies.

Reporting System

A reporting system can be designed in many ways and is typically composed of different elements. Most people are familiar with the “Whistleblower Hotline”, i.e. a whistleblower system which employees or external parties can use for reporting suspicious actions. The EU Whistleblower Directive has brought new momentum to this area. It requires that companies with more than 50 employees or an annual turnover of more than EUR 10 million establish an internal procedure for dealing with whistleblower reports, creating reporting channels as well as reporting obligations, and providing for protection against retaliation. A reporting system can be web-based, but there are other possibilities available as a supplement or alternative, for example the appointment of a confidential advocate or ombudsman whom employees or external parties can contact, and who is empowered not just to receive, but also to evaluate information. This considerably reduces the burden on legal and compliance departments.

Investigations and Sanctions

These are a central part of processing tips about improper conduct but are hardly popular among compliance officers. Often the conduct of investigations is perceived as a conflict with consulting work and avoided if possible. But the expectations are clear. The FCPA Guide states: “(…) companies should have in place an efficient, reliable, and properly funded process for investigation the allegation and documenting the company’s response, including any disciplinary or remediation measures taken.”

Leading internal investigations professionally is a specialist matter, where inexperienced compliance officers would be well-advised to stay in the background and seek external consultation. The following critical aspects typically require careful assessment and decision-making:

• Employment law issues (hearing, involvement of the works council or union representatives, warning, and dismissal, if necessary, coordination of measures with investigating authorities)
• Rights of accused employees or external parties (data protection, admissibility of evidence, e.g. from interviews)
• Pros and cons of filing criminal complaints
• Interaction with police, prosecution, and courts
• Fact finding in the context of criminal law against companies (internal investigations, cooperation with prosecution authorities, separation of corporate defense, etc.)

A Compliance Committee like the one mentioned in previous blog posts can also be especially useful in handling tips and making consistent decisions. The compliance function can coordinate with other departments such as legal, internal audit, data protection, human resources, IT, etc. to determine the appropriate course of action. Important: The compliance officer should only propose measures, while the specialist departments, such as human resources, will make the final decisions regarding actions which have implications under employment law.

Incentives

“Compliance can’t be incentivized, because everyone is expected to obey the law” is a typical objection to positive compliance incentives. With a little imagination, however, it is certainly possible to develop incentives which suit the company: The integration of compliance milestones into annual objective agreements is particularly effective. An example would be the implementation of compliance training or workshops by managers or active participation in a specific compliance project. Special efforts can also be rewarded, such as the optimization of compliance-relevant processes in a sales department.

What’s Next

Does your company have relationships with distributors, customs agents, consultants, or other business partners? Our journey through the most important elements of a CMS will continue in the next episode with the topic “Business Partner Management”.

If you are unsure how to set up your CMS successfully, please feel free to contact me.

Compliance Management
Episode 8: Communication, Training and Consulting

Compliance officers generally see informing employees about relevant compliance topics and providing training appropriate to the risks involved as an important and urgent task. And they’re right. The Compliance Officer is always well-advised to communicate and explain important matters, keeping compliance front and center among employees.

“Compulsory” and “Freestyle”

There is no question of the need for a standard corporate training program. Key to the training are the “Compliance Basics” (code of conduct) and other risk-related content (anti-corruption, antitrust law, etc.). In larger companies, these are often e-learning courses which must be completed by new employees and then regularly supplemented as refreshers. Classroom training should also be offered. The two variants are to be understood as “both and”, not as “either or”.

There are several advantages and disadvantages to be considered:

E-Learning

Pro

• Easier to organize and more time saving for many employees
• Participation easy to document

Contra

• No individual questions and per-sonal interaction
• Often only the “standard top-ics”

Classroom training

Pro

Customized contents
Questions can be submitted and the speaker can answer ques-tions

Contra

• More complex and time-consuming
• Complicated tracking (participant lists, sick leave, etc.)

However, few compliance officers realize all the possibilities of communication and training. So what could a “freestyle” option look like?

Option 1: Let’s start “at the top” – with management training. Here, an important topic is “Compliance as a Management Task”. While e-learning is useful to provide the entire workforce with a basic introduction, face-to-face training is recommended for management, for example in a half-day workshop. There, discussion can address topics such as potentially conflicting goals, implementation of compliance in business operations, dealing with compliance concerns, and much more.

Option 2: Target-group trainings (e.g. for employees in sales) are also essential. Here the (internal or external) trainer can answer legal questions, interactively analyze case studies, and respond to the exact needs of the target group. None of this would be feasible in a standardized e-learning system.

Option 3: Compliance training may often be difficult to reconcile with the high workload of many employees. One response to this can be “Nano-Learnings“: These are small “morsels” that employees can look at from time to time or access on the intranet in case of any lack of clarity.

Option 4: Does your company have a staff newsletter? Publish reports on training and other compliance activities to keep your issues in focus for the workforce.

Option 5: Training should not be limited to instructions or recommendations. Have you identified risks which can arise when employees communicate with external partners? Then design communication trainings for your employees. As an example, the sales department of a pharmaceutical company could be instructed in compliant communication with doctors: How can compliance be framed positively or even become a competitive advantage? (“If you work with us, you can be sure that everything is on the level.”)

Option 6: A Q&A session with employees (e.g. on the importance and scope of compliance, giving and receiving gifts, reporting of compliance concerns, contact persons) can address frequently requested topics, standardize answers, and save much (repetitive) consulting work. It can turn compliance from a headache to an accessible source of good advice.

Option 7: You can also conduct employee surveys on compliance. What do employees think about compliance? Do you think the issue is being taken seriously? Do you know your compliance officer? These and other questions give you a quick overview of what employees think and how you can improve their efforts in the future.

Option 8: Even the compliance department, has to be able to sell itself. “Compliance Branding” can be a step toward achieving this: Use marketing know-how to publicize compliance issues and your core messages within the company. The visual design is also important here. Always coordinate with the communications department. Uniform design of documents and consistency with other company publications will make it clear that compliance is part of the company.

Option 9: Develop new formats yourself: These can be compliance workshops or “consulting hours” (individual or group events). A “low-threshold approach” make it easier for employees to get involved in compliance issues and to contact the compliance officer in any case.

Conclusion

Compliance training and communication can be done in many ways. Choose something unusual to convince the employees of the importance of the topic (and of your work). Be creative and use different forms of communication and learning. Nowadays, employees are visually “spoiled”. You won’t get far with e-mails – instead, visual or interactive prompts are increasingly required to arouse and maintain interest in the topics.

What’s Next

The next episode continues with the topic “Reporting systems, investigations, enforcement, incentives and sanctions”.

If you are unsure how to set up and run your compliance project successfully, please feel free to contact me.

Compliance Management
Episode 7: Compliance Organization, Autonomy and Resources

“Organizing is when one person writes down what other people are doing.”
(Kurt Tucholsky)

In episode 2 of our challenge, we found out that within the scope of its duty to follow the law, management ensures that the company is organized and supervised in such a way that it complies with applicable regulations. To this end, management sets up a risk-appropriate compliance organization. Management therefore considers compliance to be a primary task.

However: For many compliance officers, any talk of a “Compliance Organization” is pure wishful thinking. Even in multinational companies, this “organization” sometimes consists of exactly one person tasked with various responsibilities such as legal oversight, compliance, and data protection – all bundled together and assigned (for example) to the company lawyer. If this is you I will show you a few tips for meeting the many and varied requirements of your job.

Tip 1: Find Allies. Compliance officers should absolutely look for a network of “allies” who can support them in compliance tasks. Meaningful alliances can, in particular, be forged with Finance/Controlling, HR, Purchasing, IT or Internal Audit. If applicable, regular and proactive coordination with the works council or union representatives is also advisable in order to be able to exchange information early on concerning issues where these bodies may have participation rights.

A further aspect, important both for managing workloads and guaranteeing the effectiveness of a CMS, is the need to anchor compliance issues in daily business operations. This focus is needed because many questions arise in this context, for example in production or sales, which is far from where the compliance officer may work. How can he or she respond effectively to these issues?

Tip 2: Play in the “Champions League”. Look for contact persons within various company divisions. The establishment of a structure of “compliance champions” has proved to be very successful in some cases, even if some preparatory work is necessary. There are employees in almost every department who have a special interest in and understanding of the topic of compliance. They can be specifically trained and informed to pass on this knowledge to their departments. Employees often find it easier to address questions to their colleagues rather than directly to the compliance officer.

In addition to technical competence, the most important characteristic of a successful compliance officer is authority. It has two facets: authority as a personality trait and the authority of the position. The latter depends on what kind of role the management has created for the compliance officer – a decision which is visible to everyone in the company.

The FCPA addresses this aspect, together with the question of “autonomy“, in very specific terms: Those (senior executives) must have appropriate authority within the organization, adequate autonomy from management (…). Adequate autonomy generally includes direct access to an organization’s governing authority, such as the board of directors and committees of the board of directors (…).. (FCPA Resource Guide, p. 58).

Tip 3: Request Involvement. The question of the specific forms which authority and autonomy take in this context is often controversial. Ideally, a compliance officer should report directly to the management and also be a member of an executive committee. Only with this level of involvement can a compliance officer gain a first-hand impression of key issues and intervene effectively. This will raise the compliance officer’s standing, thus sends a strong signal boosting the credibility of the compliance program.

Tip 4: Form a Committee. In any case – and especially if regular participation in an executive committee is not (yet) realistic – the compliance officer should encourage the establishment of a compliance committee. This committee should meet regularly (for instance, every two months), bringing together representatives from different divisions (such as the “allies” mentioned above) to discuss and decide important compliance issues. This tool often proves quite effective.

Authorities such as the United States Department of Justice (“DOJ”) increasingly emphasize the importance of sufficient financial and human resources to evaluate the effectiveness of compliance programs. In the 2019 DOJ Compliance Guidelines, the word “resources” was used 42 times on 18 pages. In the 2020 update to the Guidelines, the question of whether compliance programs receive adequate financial resources was again given special emphasis.

Tip 5: Demand a Budget. Resources are not just “nice things to have”. It is not enough to put a “compliance hat” on someone in the company and then leave them alone. Realistic budgets are essential if a company’s commitment to compliance is to be seen as credible. Compliance officers must demand realistic budgets, ideally with concrete annual spending plans for their specific compliance projects.

What’s Next

In the next episode, we will continue with the topic “Communication, Training, and Consulting”.

If you are unsure how to set up and run your compliance project successfully, please feel free to contact me.

Compliance Management
Episode 6: Management’s Commitment and Obligations

“For if the trumpet give an uncertain sound, who shall prepare himself to the battle?”
1. Corinthians 14:8

The “Tone from/at the Top”

Even if “management’s commitment and obligations” appears at first glance to be a “soft skill” requirement, it is actually an important element of an effective compliance program.

A clear commitment by the management to the company’s compliance program and organization are crucial to their success.

The FCPA Resource Guide stresses this point:

“Within a business organization, compliance begins with the board of directors and senior executives setting the proper tone for the rest of the company.”

The message could hardly be clearer: Compliance starts with management. This also means that the success of a CMS can also quickly end with management if it does not establish a convincing compliance culture within the DNA of the company.

The “Tone from/at the Middle”

However, it is not only management that must send clear signals to support compliance in their organization. Middle management is at least as important. Middle managers are typically much closer to the challenges of day-to-day business than are managing directors. Middle management decides whether a company gives mere lip service to compliance, or genuinely implements it: i.e., whether the company “walks the talk.”

“Good leaders produce good followers; but if employees in the middle of the organization are surrounded by coworkers who are lying, cheating, or stealing, they will most likely do the same, regardless of what their bosses say. So-called descriptive norms – how peers actually behave – tend to exert the most social influence.” (Epley, Nicholas/Kumar, Amit: How to Design an Ethical Organization, Harvard Business Review, Issue May-June 2019, p. 144).

Employees have a keen sense for whether executives are serious about compliance, or whether compliance talk is mere lip service, and other rules apply behind closed doors. Taking compliance seriously may actually require declining a critical business opportunity.

What concrete steps are necessary?

I clearly recall one company whose employees were to be trained on the subject of compliance. Everyone gathered in the training room. The Managing Director spoke briefly on compliance, wished everyone a productive training session, then left the room. While he “said” that lawful and ethical conduct was important, what he did sent a clear signal that he had more important things to do. No big deal? Perhaps not, but the signal such behavior sends should not be underestimated.

What specific steps can management and executives take? As usual, communication is (almost) everything. Management can keep compliance issues in focus by regularly communicating with employees. Of course, the Compliance Officer can and should support this. Management can comment on an important compliance project via internal company communication channels, or a managing director can write a foreword to the new Compliance Manual. Above all, however, management can support the Compliance Officer by associating him or her with the overall issue of compliance, especially by granting access to management circles, and consulting the Compliance Officer on compliance-related decisions.

Middle managers should act as multipliers and try to translate the Compliance Program into the daily practice of their areas and ensure that the relevance of rules to specific tasks is understood. They should be the first point of contact for their employees on compliance issues, addressing questions or concerns from their areas to the Compliance Officer and providing constructive feedback to the latter. This will put employees on notice that compliance is not an optional extra, but a central responsibility of the manager and therefore also of the employee.

Integrating middle management can make it clear what compliance really means and show how all employees can work together on implementation.

What’s Next:

In the next episode we will continue with the topic “Organization, Compliance Responsibility, Autonomy, and Resources”.

If you are unsure how to set up and run your compliance project successfully, please feel free to contact me.

Compliance Management
Episode 5: Compliance Processes – Establishing the Framework

In episode 4 of this series, we saw that guidelines – often called “policies” – are the backbone of a CMS.

What exactly are “processes”?

If guidelines provide necessary structure and mark the expectation horizon, processes transform business operations into a defined sequence of steps.

In general, a distinction is made in business processes between leadership or management processes, the value-creating core processes directly related to the company’s products or services, and supporting processes. The last category includes risk analysis processes and, therefore, compliance processes. Regardless of how detailed the process descriptions are, they should depict processes and tasks within the company as clearly as possible, and specify that they are binding.

Ideally, business processes – and thus compliance processes – should be described so that the reader understands how processes and tasks within the company are currently running (“existing processes”) and how they should run (“target processes”).

Describing Processes

Charts can often be useful in depicting processes. There are software programs (such as Visio or Lucidchart) that can help visualize processes, but for less complex processes PowerPoint shapes do the job, too.

In any case, well-known and reliable systems should be used to create the visual. For years now, the Object Management Group Inc. (“OMG”) has been defining and standardizing the basic elements of process description and the procedure for process modelling (see https://www.omg.org/).

Standard Operating Procedures (SOPs) are a common way of implementing processes. SOPs generally describe the following (1) the aim and purpose of the process, (2) its application, (3) the process itself, (4) who is responsible for it, (5) how the process is documented, and (6) steps for monitoring the process, if applicable.

Typical Regulations

Descriptions of compliance processes typically define roles and responsibilities which can be used to better manage and control especially critical (i.e. risky) activities.

The implementation of compliance processes can be illustrated by the example of interactions between the pharmaceutical industry and healthcare professionals. During such activities (training events, speaking or consultancy contracts, sponsoring, donations, etc.) compliance must be ensured with all requirements of competition and anti-corruption laws and rules of industry codes. A compliance officer will therefore carefully consider how he or she should approach this task (aside from standard approaches such as training and the preparation of contract templates) and pay particular attention to the following issues:

• Description of roles and responsibilities (who is responsible for preparing the necessary paperwork, including a complete and accurate description of the cooperation arrangements and the need for them)
• Regulation of the “dual control principle” and approval by the Compliance Officer
• Implementation the separation between medical/scientific functions and marketing/sales
• Evaluation of how services are provided
• Prerequisites for invoicing and payment as well as integration into order and payment processes
• Documentation requirements
• Implementation of control and review measures (“Monitoring”)

An important reminder: Involve stakeholders early on!

When establishing processes, it is, as always, vital to involve as many relevant departments and players in the development as possible, for example in workshops using the brown paper method.

Training and Communication

As with guidelines, systematic communication and training is essential to the implementation of compliance processes. In addition, make sure that you regularly adapt your processes and keep careful track of versions (V 1.0, V 1.1, etc.), so that you always understand the big picture!

What’s Next:

In the next episode, we’ll address compliance procedures.

If you are unsure how to set up and run your compliance project successfully, please feel free to contact me.

Compliance Management
Episode 4: Compliance Guidelines – Defining the Framework

Solid guidelines – often also called “policies” – are the basis for a Compliance Management System (CMS) which builds binding commitments.

Guidelines as the backbone of a CMS

As mentioned in the previous post, many compliance officers start immediately by creating and promulgating guidelines they consider necessary. This creates a sense of security, since you now have progress to show “on paper”.

True is: A concise, comprehensible set of guidelines adapted to company-specific risks provides necessary structure and establishes the expectation horizon. Once a thorough risk assessment has fostered understanding of a company’s sensitive, risk-prone areas, guidelines provide a framework for addressing these risks at the regulatory level. They represent a lasting standard against which the Compliance Program and the behavior of the employees will be measured.

But what exactly are guidelines? Put simply, guidelines are intended to translate “external” laws into the corporation’s language. This “language” should reflect the reality of the company and – of course – should be comprehensible. This may seem obvious, but experience shows this expectation is not always fulfilled.

The following “Dos & Don’ts” should be particularly highlighted:

Do:

• Clear structure and language
• Where possible: visuals
• Definition of central terms
• Reference to and consistency with other guidelines

Don’t:

• Long texts
• Copy chunks of legal text
• Unclear legal terms and wording
• Absence of company-related examples

There is rarely a strong emphasis on formal criteria, at least in the case of guidelines in the compliance area. Compliance officers within companies are therefore usually free to decide on the content and the formulation of specific rules, as long as the rules serve to successfully organize collective behavior in the company. It is important to note here that there are different “rule types” [1], for example:

• “Boundary rules”, which explain which behavior is unacceptable
• “Priority rules”, which prescribe a solution in case of conflict
• “Implementation rules”, which explain how a certain guideline should be “lived” within the company
• “Communication rules” indicating which departments/persons need be informed about certain actions or decisions

It is not necessary to use every rule type; the selection of types depends largely on the individual case. However, one thing is clear: Simple Rules increase the overall likelihood that addressees will adhere to them.

Important: Involve stakeholders early on!

Paper, as we know, is patient. Even a guideline crafted with all possible care may not necessarily meet with approval. Therefore, make sure that all important departments are included and involved in the policy. “Involved” here definitely means inviting an active contribution.

Training and Communication

It is not enough to create a guideline only to bury it somewhere in the depths of the corporate intranet. The “roll-out” – that is, the systematic communication, training and implementation of the new rules – is equally important. The success of the policy depends on its being anchored in the company’s DNA. Creating a set of frequently asked questions and answers (“Q&A”) explaining guidelines is often particularly useful. The most important aspects can be explained again in the questions and answers. Add questions employees ask you about the policy. Answer these questions clearly and accurately. This exercise will also help you, as a compliance officer, carefully consider the scope and consequences of the regulations. The best part is: You can continue to update and improve the Q&A over time, which simultaneously creates a record of your consulting activities.

[1] Donald Sull/Kathleen M. Eisenhardt, Simple Rules: How to Thrive in a Complex World.

What’s Next:

In the next episode, we’ll address compliance procedures.

If you are unsure how to set up and run your compliance project successfully, please feel free to contact me.

Compliance Management
Episode 3: Risk Assessment – Set and Stay the Course

Careful risk analysis and assessment are the central elements of an effective Compliance Management System (CMS). A look at the current international compliance standards makes this clear:

• UK Bribery Act: The company assesses the nature and extent of exposure to internal and external (corruption) risks. Risk analyses and assessments ensure that the existing risks are identified and prioritized accordingly, depending on business volume, activities, customers and markets.
• Foreign Corrupt Practices Act: The compliance policies and processes are developed on the basis of periodic risk analyses and assessments which take into account the individual circumstances of the company
• ISO 37001: “Risk analysis and assessment” are listed as a central component

Why emphasis on risk assessment? If the specific risks a company faces are never precisely defined, all other elements of the CMS will be misguided and ineffective. The core questions are: What guidelines and processes are necessary? What should training and communication focus on? What safeguards should be put in place? The answers to these questions will be vague unless they are based on a clear understanding of the risks.

Methodological Problems

Despite its importance, risk analysis and assessment are often neglected in legal and compliance departments. Many compliance officers start right away by drafting guidelines they deem necessary, or by providing training on specific subjects. This is understandable, and there’s nothing necessarily wrong with this approach. A thorough risk assessment involves real work. However, only companies which understand their risks exactly can develop risk-specific guidelines, and training and monitoring which are precisely targeted to their real situation (this is called the “risk-based approach”).

A Better Way: The Systematic Approach

A robust risk assessment sets the course for keeping a company’s compliance activities on track in the medium and long term.

The compliance risk analysis should, in any case, be initially as broad as possible, focusing on “classic” risk areas. Examples include: ^[1]

As with the previous step of defining the areas of responsibility ^[2], a broad initial survey of all potential risk areas doesn’t mean that the compliance officer is eventually responsible for all of these risk areas, or will be responsible for them after significant risks have been identified. Rather the focus is on identifying activities or circumstances that could cause considerable liability risks or other harm to the company and the employees acting on its behalf (in particular, liability for criminal and regulatory or antitrust offenses) and taking the necessary cross-functional risk reduction measures for these activities.

Procedure for Risk Analysis and Assessment

The following procedure has proven effective for conducting a risk assessment:

Throughout the process of risk analysis and assessment, the following aspects must be kept firmly in mind:

• What exactly is a “risk” in this context? A risk is the possibility of an illegal act which can lead to significant consequences such as sanctions (individually or for the company) or a loss of reputation. Examples: Employees bribing foreign officials or making deals with competitors.
• Within the framework of a risk assessment, we look at activities or circumstances that may be linked to such risks. Example: A company sells products requiring approval in China and relies on regulatory advice from local service providers. There’s nothing wrong with this in principle. Nevertheless, there is good reason to closely examine and, if necessary, strengthen the safeguards against this risk (for instance, by implementing thorough screening of these service providers, including background checks).Risky activities and circumstances may include the following:
  • Risks associated with the specific industry (e.g. intensive regulation in the pharmaceutical or medical-device sector)
  • Geographic aspects (negative Corruption Perception Index, ^[3] political instability)
  • Importance of licenses and permits for a company (e.g. as a condition for operating plants)
  • The degree of regulatory supervision and control, which may include local authorities taking more decisive action against foreign companies than locally owned ones
  • Scope and importance of assets subject to customs duties or employees subject to entry regulations
  • Opening up new markets in countries with poorly developed infrastructure
  • Coordination with business partners (e.g. distributors, consultants)
  • Joint projects (e.g. joint ventures which grant control in purely legal terms but involve unfavorable conditions for its effective exercise)
• The aim of risk analysis and assessment is not to eliminate risks. It’s hard to imagine a business without risks, and some risks are even inherent in the very nature of business activity and cannot be eliminated. Example: When the business involves significant dependence on official decision-makers, the risk of corruption can never be completely eliminated. However, it can be controlled as far as possible through the use of targeted measures such as compliance audits, consulting, and training.
• During the implementation phase, it should also be clearly stated what a risk assessment is not: It is neither an internal investigation nor an audit. It is crucially dependent on employees feeling they can report as openly as possible on potential risks in their areas of responsibility.

At the end of a risk analysis and should be a clear assessment: Which risks were identified? Which safeguards are already in place? Are they sufficient? Where are possibilities for improvement? As the compliance officer, you don’t have to reinvent the wheel here. Instead, look for existing safeguards you can build on. Perhaps there is already sanctions-list screening or a strong ordering process. Using them as a base, develop meaningful additions to effectively address the identified risks. At the end of a risk assessment, you will know which guidelines and processes are still missing and what exact subjects training should address. In other words: You’ll be able to determine your course and set sail.

What’s Next:

In the next episode, we’ll address compliance guidelines.

If you are unsure how to set up and run your compliance project successfully, please feel free to contact me.

^[1] See also the detailed overview “Risk Catalogue” from DICO e. V.
^[2] See Episode 2 of the 12-Month Compliance Challenge.
^[3] transparency.de/cpi.